Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
CVEVerifiedSignal 69/100
CVE-2026-115560
Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
Found in 5 reports: Patched, Not Over: PHP2Shell Exploits Keep Spreading Underground; 26th October – Threat Intelligence Report; CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP · all 5 reports
CVE
Known vulnerability being actively exploited in the wild.
MISP Category
vulnerability
Confidence
84%
Signal Score
69 / 100
IDS Rule
No
Threat Context
Threat Actors2
Tags
Feed Intelligence Summary
5 reports84% confidence
Rapid7
6d ago
3 IOCs in report
SOCRadar
Oct 21, 2026
PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Critical PHP RCE Flaws, Affected Versions, and How to Fix Them
4 IOCs in report
ORKL Threat Library
Jan 1, 1
74 IOCs in report
Activity Timeline
Threat Activity Heatmap
Related Reports
Patched, Not Over: PHP2Shell Exploits Keep Spreading Underground
ThreatMon29 IOC
26th October – Threat Intelligence Report
Check Point Research5 IOC
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
Rapid73 IOC
PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Critical PHP RCE Flaws, Affected Versions, and How to Fix Them
SOCRadar4 IOC
⚡ Weekly Recap: This2shell, That2shell, Everything's an Rce? Rogue Ai, Supply Chain Chaos and More
ORKL Threat Library74 IOC